Open VSX removes 77 evil twin extensions that impersonate developer tools and exfiltrate host, workspace, Git, and CI data.

A macOS ClickFix campaign uses more than 250 domains and server-side fingerprinting to hide AMOS lures from crawlers and ...

Another Shai-Hulud variant hits npm packages, worming its way into hundreds of packages.

AI is helping attackers create disposable phishing infrastructure and rapidly evolving toolkits that blocklists cannot track ...

Catches of predatory bull and tiger sharks are sparking public debate about shark fishing techinques, conservation and public ...

BSides Las Vegas 2026 spent three days making the case that AI coding tools are supply chain attack targets. ChainDrop, a ...

A hijacked GitHub account let the Shai-Hulud worm pass npm's trust check, spreading through packages with 2 billion monthly ...

Microsoft Threat Intelligence observed a macOS ClickFix campaign distributing infostealers, including MacSync and Atomic Stealer (AMOS), through a large cluster of look-alike domains. The campaign ...

Getting a 503 maximum threads error? Follow these quick troubleshooting steps to restore access and fix server or CDN capacity problems.

Malware infected at least 444 npm packages spanning 2,000 versions, threatening software with over two billion monthly installs. Attackers compromised maintainer Jared Wray's account, then used stolen ...

The director’s cut of The X-Files: I Want to Believe (or to give it its new title, The X-Files: I Want to Believe — Vrach ...

Go beyond HTML with practical workflows to uncover rendering issues, weak site structure, and other obstacles to AI ...